PT-2025-12408 · Mattermost · Mattermost

Caleb Roseland

·

Publicado

2025-03-21

·

Atualizado

2025-03-28

·

CVE-2025-24920

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.8 Mattermost versions 10.3.x through 10.3.3 Mattermost versions 10.4.x through 10.4.2 Mattermost versions 10.5.x through 10.5.0
Description The issue allows authenticated users to create or update bookmarks in archived channels, as the affected versions of Mattermost do not properly restrict bookmark creation and updates in such channels.
Recommendations For versions 9.11.x through 9.11.8, update to a version that restricts bookmark creation and updates in archived channels. For versions 10.3.x through 10.3.3, update to a version that restricts bookmark creation and updates in archived channels. For versions 10.4.x through 10.4.2, update to a version that restricts bookmark creation and updates in archived channels. For versions 10.5.x through 10.5.0, update to a version that restricts bookmark creation and updates in archived channels.

Correção

Incorrect Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BIT-MATTERMOST-2025-24920
CVE-2025-24920
GHSA-RP74-X43M-CPW3
GO-2025-3552
OPENSUSE-SU-2025:14937-1

Produtos afetados

Mattermost